Back-Channel Attribute Authority

[Joshua Riffle]

So I noticed in an article from the SWITCH federation that their
configuration procedure for a Shibboleth IDP is to have Tomcat accepting
secure traffic on port 443 (HTTPS) and 8443. They suggest 443/HTTPS should
be used for the SSO Endpoints in your IDP's Metadata serving a certificate
that is signed by a reputable certificate authority. Whilst 8443 should be
accepting traffic for your Attribute Resolution/Authority Endpoints and
serving a self-signed certificate.

I see this does seem to be a trend with other Identity Providers in
InCommon federation metadata but I haven't seen a documented technical
reason why you shouldn't just use the same port and certificate for all of
your endpoints? So my questions is simply -- why? I'd like to understand
this better.

Here's the referenced SWITCH article:
https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/#overview

Joshua Riffle
Software Engineer
*Azusa Pacific University*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130712/33909b75/attachment.html